Random Network Failures

[Damitha]

Hello

I am experiencing a strange issue with Fortigate 600C firewall. Time to time whole network is disconnect and reconnect within 3-5 secs. There is no any ping drops. But all the user sessions are dropping. (eg. Internet, SAP users, IPPhones, etc..)

The unit was on FortiOS 5.2.5 and I have upgraded it to 5.2.11 (5.2.5 -> 5.2.7 -> 5.2.9 -> 5.2.11) also changed the hardware too. (Tried different FG 600C unit) But still unable to find the cause to this issue. Please assist me to identify this issue.

Thank you

Damitha 

[rdesilva_FTNT]

Hi Damitha,

There can be many reasons why users/services experiencing dropouts.

1.During the outage, can you access other networks that are directly connected to the Fortigate, apart from the Internet link?

2.Do you see the same issue if you bypass the Fortigate?

3.The affected services, are they routed via a IPSec VPN ---> Datacenter ---> Internet or is it a direct link to the internet?

Best option will be to raise a support ticket with Fortinet TAC @ https://support.fortinet.com

Kind regards,

Rukshan

[emnoc]

Do you have logging enabled? Can you reviews logs at the time of the event(s)?

Since you changd hardware, changed code, what else do you have in  the network path?

Also what do you mean exactly by

There is no any ping drops. But all the user sessions are dropping. (eg. Internet, SAP users, IPPhones, etc..)

If you have applications failing, run diagsnotsic or logs against the application and  look for similarities  (  SIP registeration timeouts for example....)

[Damitha]

Since the outage is less than 5 seconds it is very hard to troubleshoot. But we started continues ping to internet, internel servers, other internel networks and during the outage there is no any timeouts. But SAP user sessions are disconnected. Same for the IP phones, FortiWiFis... There are no IPSec VPNs. All the network segments are directly connected to the firewall. And 1 trunk port which has about 5 vlans. All the routing and access handled by the firewall itself. There are no any event logs related to this. There were some logs related to webfilter, appfilter memory logs. I have disabled the memory logs for sometime, but the issue happened. The unit has 3 VPN links, 3 Server Segments, 2 FortiWiFi subnets, 1 Trunk Port (all user VLANs), and 2 internet links configured for Wan link load balancing.

[dive4fun]

Hi Damitha

Do you have any solution for your issue?

We have the issue that from timet to time, the SAP connections are reseted with an WSAECONNRESET error on the client. I dont know if other connection are allso affected, but SAP is realy picky with connection disruptions.

 

[mahesh_secure]

Hi

having only issue with traffic which is passing through fortigate?

or issue in the same subnet ? ( eg: connection lost between 192.168.1.1 to 192.168.1.2)

did you make any change in the global timer ?

check it

config system global

show full-config

Regards

Mahesh

[dive4fun]

Hi

The issue arise with the Network Segmentation, now the clients have to traverse the Firewall (Traffic is allowed) to get to the SAP Server. Also the issue only happens from time to time, sometimes once a day and sometimes once a week.

What do you mean with global timer? The session timeout? For the SAP traffic this is set to 8 h.

Best regards

[mahesh_secure]

Hi See the below global timer settings config system global set tcp-halfclose-timer set tcp-halfopen-timer set tcp-timewait-timer set udp-idle-timer Did you make any change on this settings? Fortigate recommend this settings when device experience high cpu/memory usage. Remember any changes done on this part? Share the below command output Config system global Show full- configuration Regards Mahesh

[dive4fun]

Hi

the Global Timer settings are as folow

set tcp-halfclose-timer 120 set tcp-halfopen-timer 10 set tcp-option enable set tcp-timewait-timer 1 set udp-idle-timer 180

I think this are the default values

I just take over the case so I dont know if there were did some changes erlier.

I've attached the Output of the configuration.

Thanks and best regards